Data processing agreement

1. The parties and their roles

• You, the company named in the order, are the controller of the personal data in your ASK workspace. You decide why and how it is processed.
• We are the processor and process it only on your behalf:

This agreement meets the requirements of Article 28 of the EU and UK General Data Protection Regulation and of Article 9 of the Swiss Federal Act on Data Protection, as they apply to you. If it conflicts with the terms of use or your order on personal data, this agreement comes first.

2. What we process, and why

• Purpose: to provide ASK to you: search, answers with sources, agents, Buddies, schedules, workflows, chat apps and the features you switch on, and to keep the service secure, supported and billed correctly.
• People concerned: your employees and other people with an account in your workspace; and the people who appear in the content of the tools you connect, such as colleagues, customers, suppliers and the recipients of messages.
• Kinds of data:
  • account and directory data: names, work e-mail addresses, roles and groups;
  • the content of the tools you connect: documents, e-mails, messages, tickets, records, calendars and similar, with their access rights;
  • what your people do in ASK: questions, chats, answers, notes, Buddies, schedules and workflows;
  • usage and security records: usage per person and company, sign-ins and the audit log.
• Special categories (such as health data) are processed only where they are in the content you connect. You decide whether to connect such content.
• Duration: while your agreement runs, then until the deletion in section 9.

3. Your instructions

We process the data only on your documented instructions. Your instructions are this agreement, your order, the terms of use, and what your administrators set in your workspace, such as the tools connected, the AI used, who may use which features and how long data is kept. If we believe an instruction breaks data protection law, we tell you and may hold it until you confirm or change it.

We use the data for nothing else. In particular, we never use it to train AI models, never sell it, and never use it for advertising. We may use counts of usage that identify no person to run, bill and improve the service.

If the law requires us to process the data in another way, for example on an authority's order, we tell you beforehand unless the law forbids it.

4. The AI

• Your own AI provider: if you connect your own provider, your data goes to it under your own agreement with that provider. It is not our sub-processor.
• ASK's AI: if you use ASK's AI, we choose and run the models and the companies that provide them. Those companies are our sub-processors (section 6). We use only models whose terms don't allow training on your data.

5. Our people

Everyone at Talist GmbH who can reach the data is bound to confidentiality and receives only the access their work needs. Our staff see settings, usage and costs per company, but not your documents or your people's chats.

6. Sub-processors

• You authorise us to use the sub-processors listed on our sub-processors page, with their purpose, countries and transfer basis.
• Before we add or replace one, we e-mail your administrators at least 30 days before it starts. Only when one must be replaced urgently, to keep the service secure or available, may the notice be shorter; then we tell you as soon as we can and say why.
• You may object on reasonable data protection grounds before the start date. We will then look for a solution with you. If we can't find one, you may end the agreement before the change applies to you, without any charge for the time after.
• We bind every sub-processor to data protection duties at least as strict as ours, and we remain responsible to you for its work.

7. Where the data is processed

We store the database and uploaded files in Switzerland, and run the application servers, including the search index, in the European Union. A sub-processor outside Switzerland, the EU and the UK processes data only where the country has an adequate level of protection or where we have agreed the safeguards the law requires, such as the EU standard contractual clauses with the Swiss and UK additions. The transfer basis of each sub-processor is shown on the sub-processors page.

8. Security

We protect the data with technical and organisational measures that fit the risk and the current state of the art. They include:

• each company's data kept separate from every other company's, in its own database area and search index;
• encrypted connections, and connection secrets and access keys encrypted with keys of their own for each company, never shown again after they are saved;
• access rights taken from your connected tools and checked on every search, answer and action, so that unknown access shows nothing;
• sign-in through your company's own identity provider, two-step verification for administrators of the platform, and fresh sign-in for sensitive changes;
• an audit log of security-relevant actions that can't be changed afterwards;
• backups kept for 35 days, then deleted;
• no analytics or tracking services, and no data sent to anyone for their own purposes;
• automated security checks of our code and its dependencies, and tests on every change that prove one company can't see another's data.

We may improve these measures over time, but never lower the overall protection.

9. Helping you, and the end of the agreement

• People's rights: ASK gives you the tools to answer requests from the people concerned: each person can download their own data and delete their own chats, and your administrators can export, correct and delete data. If you need more, we help.
• Assessments: we provide the documents your company needs to assess and explain its use of ASK (privacy notice, data protection impact assessment, employee information), and help where you need more.
• Breaches: if we become aware of a breach of security affecting your data, we tell you without undue delay and within 48 hours at the latest, with what we know, and keep you informed while we contain it.
• Retention: we keep data for as long as your settings say. For example, chats are deleted after 90 days unless your company chooses another period.
• End of the agreement: your administrators can download an export of your workspace. Thirty days after the agreement ends we delete all your data, including its encryption keys. Backups expire within a further 35 days. We keep only what the law requires us to keep, such as invoices.

10. Checks and audits

We give you the information you need to check that we keep this agreement. Once a year, or after a breach, you may have it audited by an independent auditor bound to confidentiality, with at least 30 days' notice, during our business hours and without access to other companies' data. Each party bears its own costs. Where we hold recent independent reports or certificates, we may provide them instead.

11. Liability, changes and law

• Liability follows the terms of use, as far as data protection law allows.
• We may change this agreement where the law or the service requires it, and tell your administrators at least 30 days before. A change never lowers the protection of your data.
• This agreement is governed by Swiss law, with the courts at our registered office. Where the EU or UK General Data Protection Regulation applies to you, we keep its requirements for processors.

Questions about this agreement? Write to us through our contact form.